Chage tool related settings: max-days, min-days and warn-age, for get… #190

ipruteanu-sie · 2024-03-11T08:29:13Z

5.6.1.{1-3} rules - chage impl

Overall Review of Changes:
Adding chage settings for users

Issue Fixes:
#189

Enhancements:
Completing rules 5.6.1-3

How has this been tested?:
Tested on VM

…ting CIS-Passes on rules 5.6.1.{1-3} Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

updates: - [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

@rjacobs1990

* change logic thanks to @rjacobs1990 see ansible-lockdown#175 * 1.2.1 force gpg import rhel * fix missing facts --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

@ipruteanu-sie

* Issue ansible-lockdown#170, PR ansible-lockdown#181 thanks to @ipruteanu-sie * issue ansible-lockdown#182, PR ansible-lockdown#183 thansk to @ipruteanu-sie * PR ansible-lockdown#180 thanks to @ipruteanu-sie and @raabf * Addressed PR ansible-lockdown#165 thanks to @ipruteanu-sie * PT ansible-lockdown#184 addressed thansk to @ipruteanu-sie * updated credits * typo and ssh allow_deny comments * enable OS check --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

ipruteanu-sie · 2024-03-11T16:06:14Z

L.E.: About newest comit:

As one may notice below, value for the shells have no leading spaces, therefore the below conditional

"/usr/sbin/nologin" != "      /bin/false"

will be evaluated as True, forcing the conditionals to not work as intended.

changed: [192.168.126.152] => (item=root) => {
    "ansible_loop_var": "item",
    "changed": true,
    "cmd": "chage --warndays \"7\"  \"root\"",
    "delta": "0:00:00.091259",
    "end": "2024-03-11 10:47:30.783333",
    "invocation": {
        "module_args": {
            "_raw_params": "chage --warndays \"7\"  \"root\"",
            "_uses_shell": true,
            "argv": null,
            "chdir": null,
            "creates": null,
            "executable": null,
            "removes": null,
            "stdin": null,
            "stdin_add_newline": true,
            "strip_empty_ends": true,
            "warn": false
        }
    },
    "item": {
        "dir": "/root",
        "gecos": "root",
        "gid": 0,
        "id": "root",
        "password": "x",
        "shell": "/bin/bash",
        "uid": 0
    },
    "msg": "",
    "rc": 0,
    "start": "2024-03-11 10:47:30.692074",
    "stderr": "",
    "stderr_lines": [],
    "stdout": "",
    "stdout_lines": []
}
skipping: [192.168.126.152] => (item=bin)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/bin",
        "gecos": "bin",
        "gid": 1,
        "id": "bin",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 1
    },
    "skip_reason": "Conditional result was False"
}
skipping: [192.168.126.152] => (item=daemon)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/sbin",
        "gecos": "daemon",
        "gid": 2,
        "id": "daemon",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 2
    },
    "skip_reason": "Conditional result was False"
}
...
}

uk-bolly · 2024-03-14T17:09:54Z

hi @ipruteanu-sie

Thank you as always for the PR and feedback, i'm trying to undertsnad how you have so many commits when so many are already in place.
We seem to be adding files and changes that are already committed back in meaning that we are checking thing through multiple times.

Is there any chance you could pull the latest and just make the changes you need?
That should hopefully mean we are only looking at the files you are trying to change.

Many thanks as always

uk-bolly

updates: - [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

…sible-lockdown#188) * Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Signed-off-by: John Foster <robopickle@proton.me> * Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Removed debug messages Signed-off-by: John Foster <robopickle@proton.me> --------- Signed-off-by: John Foster <robopickle@proton.me>

updates: - [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

updates: - [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

ipruteanu-sie · 2024-03-26T19:10:56Z

Hi @uk-bolly: #196 was created instead of current one.

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

@ipruteanu-sie

* Issue #170, PR #181 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * issue #182, PR #183 thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR #180 thanks to @ipruteanu-sie and @raabf Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed PR #165 thanks to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PT #184 addressed thansk to @ipruteanu-sie Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated credits Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * typo and ssh allow_deny comments Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * enable OS check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * PR - #198 addressed thanks to @brakkio86 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Addressed issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Additional vars for issue #190 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated pre-commit version Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * consistent quotes around mode Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * moved audit added discoveries Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed unneeded vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * audit moved to prelim Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tidy up Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * improved new variable usage Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed logic 6.2.10 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * addressed #197 thanks to @mark-tomich Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updates for audit section Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed naming Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * added prelim to includes Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

ipruteanu-sie and others added 5 commits March 11, 2024 09:38

Chage tool related settings: max-days, min-days and warn-age, for get…

e4d6b7d

…ting CIS-Passes on rules 5.6.1.{1-3} Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

Gpg import for rhel servers (ansible-lockdown#185)

e2de952

* change logic thanks to @rjacobs1990 see ansible-lockdown#175 * 1.2.1 force gpg import rhel * fix missing facts --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

4Upstream: Adjusting strings used for user-shells conditionals

f3be71b

Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>

pre-commit-ci bot and others added 4 commits March 26, 2024 20:57

[pre-commit.ci] pre-commit autoupdate (ansible-lockdown#192)

918f936

updates: - [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

ipruteanu-sie mentioned this pull request Mar 26, 2024

Duplicate of #190 #196

Closed

ipruteanu-sie closed this Mar 26, 2024

uk-bolly added a commit that referenced this pull request Apr 10, 2024

Addressed issue #190

44911b8

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

uk-bolly added a commit that referenced this pull request Apr 10, 2024

Additional vars for issue #190

2d5ec1d

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

uk-bolly mentioned this pull request Apr 10, 2024

April_24 updates #201

Merged

uk-bolly added a commit that referenced this pull request Jun 5, 2024

improved tests based upon #190 thanks to @ipruteanu-sie

bd7c4e3

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

This was referenced Jun 6, 2024

June24 updates #209

Merged

Release to main #210

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Chage tool related settings: max-days, min-days and warn-age, for get… #190

Chage tool related settings: max-days, min-days and warn-age, for get… #190

ipruteanu-sie commented Mar 11, 2024

ipruteanu-sie commented Mar 11, 2024

uk-bolly commented Mar 14, 2024

ipruteanu-sie commented Mar 26, 2024

Chage tool related settings: max-days, min-days and warn-age, for get… #190

Chage tool related settings: max-days, min-days and warn-age, for get… #190

Conversation

ipruteanu-sie commented Mar 11, 2024

ipruteanu-sie commented Mar 11, 2024

L.E.: About newest comit:

uk-bolly commented Mar 14, 2024

ipruteanu-sie commented Mar 26, 2024